<!DOCTYPE html>
<html>
<head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge" />
  
  <title>【SSH】使用SSH登录远程主机，并禁用密码登录 | 程序小工  | Just do it!</title>
  <meta name="description" content="遇见更好的自己~" />
  <meta name="keywords" content="" />
  <meta name="HandheldFriendly" content="True" />
  <meta name="apple-mobile-web-app-capable" content="yes">
  <link rel="shortcut icon" href="/">
  <link rel="alternate" href="/atom.xml" title="程序小工  | Just do it!">
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  <meta name="description" content="对远程主机进行登录管理，一方面可以简化日常频繁登录的密码和 ip 输入步骤，另一方面，也可以提高远程主机的安全性，避免远程主机被“黑客”轻易攻击。 也借此加强对 Linux 文件权限的认识和理解。">
<meta name="keywords" content="ssh">
<meta property="og:type" content="article">
<meta property="og:title" content="【SSH】使用SSH登录远程主机，并禁用密码登录">
<meta property="og:url" content="http://blog.i2arch.tech/2018/07/30/linux-ssh/index.html">
<meta property="og:site_name" content="程序小工  | Just do it!">
<meta property="og:description" content="对远程主机进行登录管理，一方面可以简化日常频繁登录的密码和 ip 输入步骤，另一方面，也可以提高远程主机的安全性，避免远程主机被“黑客”轻易攻击。 也借此加强对 Linux 文件权限的认识和理解。">
<meta property="og:locale" content="zh-Hans">
<meta property="og:updated_time" content="2018-08-15T07:08:23.927Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="【SSH】使用SSH登录远程主机，并禁用密码登录">
<meta name="twitter:description" content="对远程主机进行登录管理，一方面可以简化日常频繁登录的密码和 ip 输入步骤，另一方面，也可以提高远程主机的安全性，避免远程主机被“黑客”轻易攻击。 也借此加强对 Linux 文件权限的认识和理解。">
    
  <link href="https://fonts.googleapis.com/css?family=Inconsolata|Titillium+Web" rel="stylesheet">
  <link href="https://fonts.googleapis.com/css?family=Roboto+Mono" rel="stylesheet">
  <link href='//cdn.bootcss.com/node-waves/0.7.5/waves.min.css' rel='stylesheet'>
  <link rel="stylesheet" href="/style.css">
  <script>
    function setLoadingBarProgress(num) {
      document.getElementById('loading-bar').style.width=num+"%";
    }
  </script>
</head>

<body>
  <div id="loading-bar-wrapper">
  <div id="loading-bar"></div>
</div>


  <script>setLoadingBarProgress(20)</script>
  <header class="l_header">
	<div class='wrapper'>
		<div class="nav-main container container--flex">
			<a class="logo flat-box" href='/' >
				程序小工  | Just do it!
			</a>
			<div class='menu'>
				<ul class='h-list'>
					
						<li>
							<a class='flat-box nav-home' href='/'>
								<i class='icon icon-list2'></i>
								首页
							</a>
						</li>
					
						<li>
							<a class='flat-box nav-archives' href='/archives'>
								<i class='icon icon-bookmark'></i>
								归档
							</a>
						</li>
					
						<li>
							<a class='flat-box nav-about' href='/about'>
								<i class='icon icon-user'></i>
								关于
							</a>
						</li>
					
				</ul>
				<div class='underline'></div>
			</div>
			
				<div class="m_search">
					<form name="searchform" class="form u-search-form">
						<input type="text" class="input u-search-input" placeholder="Search" />
						<span class="icon icon-search"></span>
					</form>
				</div>
			
			<ul class='switcher h-list'>
				
					<li class='s-search'><a href='javascript:void(0)'><span class="icon icon-search flat-box"></span></a></li>
				
				<li class='s-menu'><a href='javascript:void(0)'><span class="icon icon-menu flat-box"></span></a></li>
			</ul>
		</div>

		<div class='nav-sub container container--flex'>
			<a class="logo" class="flat-box" href='javascript:void(0)'>
				Word of Forks
			</a>

			<ul class='switcher h-list'>
				<li class='s-comment'><a href='javascript:void(0)'><span class="icon icon-chat_bubble_outline flat-box"></span></a></li>
				<li class='s-top'><a href='javascript:void(0)'><span class="icon icon-arrow_upward flat-box"></span></a></li>
				<li class='s-toc'><a href='javascript:void(0)'><span class="icon icon-format_list_numbered flat-box"></span></a></li>
			</ul>
		</div>
	</div>
</header>
<aside class="menu-phone">
	<nav>
		
			<a href="/" class="nav-home nav">
				首页
			</a>
		
			<a href="/archives" class="nav-archives nav">
				归档
			</a>
		
			<a href="/about" class="nav-about nav">
				关于
			</a>
		
	</nav>
</aside>

    <script>setLoadingBarProgress(40);</script>
  <div class="l_body">
    <div class='container clearfix'>
      <!-- 左侧内容 -->
      <div class='l_main'>
        <article id="post-linux-ssh"
  class="post white-box article-type-post"
  itemscope itemprop="blogPost">
	<section class='meta'>

	<h2 class="title">
  	<a href="/2018/07/30/linux-ssh/">
    	【SSH】使用SSH登录远程主机，并禁用密码登录
    </a>
	</h2>

	<div class="pagenav">
		<time>
			2018-07-30
		</time>

		
    
    <div class='cats'>
        <i class="icon icon-bookmark"></i>
        <a href="/categories/Linux/">Linux</a>
    </div>


		
			<div class="pagetags">
				<i class="icon icon-price-tag" style="margin-right: 2px;"></i>
				
					<a href="/tags/ssh/" style="margin-left: 3px;">
						ssh
					</a>
				
			</div>
			
	</div>
	</section>

	
	<section class="toc-wrapper"><ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#本地生成-ssh-秘钥"><span class="toc-text"> 本地生成 SSH 秘钥</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#生成本机系统的-ssh-公钥"><span class="toc-text"> 生成本机系统的 ssh 公钥</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#复制公钥"><span class="toc-text"> 复制公钥</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#远程主机配置-ssh"><span class="toc-text"> 远程主机配置 ssh</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#使用密码登录到远程主机"><span class="toc-text"> 使用密码登录到远程主机</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#查看远程主机的-ssh-配置"><span class="toc-text"> 查看远程主机的 ssh 配置</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#设置文件和目录权限"><span class="toc-text"> 设置文件和目录权限</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#对-ssh-进行配置"><span class="toc-text"> 对 ssh 进行配置</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#本地-ssh-配置进行快捷登录"><span class="toc-text"> 本地 ssh 配置进行快捷登录</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#配置-ssh"><span class="toc-text"> 配置 ssh</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#进行-ssh-方式登录远程主机"><span class="toc-text"> 进行 ssh 方式登录远程主机</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#总结"><span class="toc-text"> 总结</span></a></li></ol></section>
	

	<section class="article typo">
		<div class="article-entry" itemprop="articleBody">
				<span class="zhaiyao">[摘要]</span>
			<p>对远程主机进行登录管理，一方面可以简化日常频繁登录的密码和 ip 输入步骤，另一方面，也可以提高远程主机的安全性，避免远程主机被“黑客”轻易攻击。<br>
也借此加强对 Linux 文件权限的认识和理解。</p>
<a id="more"></a>
<h2 id="本地生成-ssh-秘钥"><a class="markdownIt-Anchor" href="#本地生成-ssh-秘钥"></a> 本地生成 SSH 秘钥</h2>
<h3 id="生成本机系统的-ssh-公钥"><a class="markdownIt-Anchor" href="#生成本机系统的-ssh-公钥"></a> 生成本机系统的 ssh 公钥</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">ssh-keygen</span><br></pre></td></tr></table></figure>
<p>默认保存路径为 <code>~/.ssh/</code></p>
<p>[windows 对应为<code>C:\Users\Administrator\.ssh\</code>][mobaxterm对应为<code>/home/mobaxterm/.ssh/</code>]</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 公钥路径</span></span><br><span class="line">~/.ssh/id_rsa.pub</span><br><span class="line"></span><br><span class="line"><span class="comment"># 私钥路径</span></span><br><span class="line">~/.ssh/id_rsa</span><br></pre></td></tr></table></figure>
<h3 id="复制公钥"><a class="markdownIt-Anchor" href="#复制公钥"></a> 复制公钥</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">cat ~/.ssh/id_rsa.pub</span><br></pre></td></tr></table></figure>
<h2 id="远程主机配置-ssh"><a class="markdownIt-Anchor" href="#远程主机配置-ssh"></a> 远程主机配置 ssh</h2>
<h3 id="使用密码登录到远程主机"><a class="markdownIt-Anchor" href="#使用密码登录到远程主机"></a> 使用密码登录到远程主机</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">ssh &#123;登录用户&#125;@&#123;ip地址&#125;</span><br><span class="line"></span><br><span class="line">输入密码后进入远程主机系统</span><br></pre></td></tr></table></figure>
<h3 id="查看远程主机的-ssh-配置"><a class="markdownIt-Anchor" href="#查看远程主机的-ssh-配置"></a> 查看远程主机的 ssh 配置</h3>
<p>配置文件目录<code>/etc/ssh/</code></p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">/etc/ssh/sshd_config</span><br></pre></td></tr></table></figure>
<p>对以下参数进行设置：</p>
<figure class="highlight"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 默认的认证公钥文件</span></span><br><span class="line">AuthorizedKeysFile .ssh/authorized_keys</span><br></pre></td></tr></table></figure>
<p>将<code>本地的公钥</code>复制到<code>远程的公钥认证文件</code> [~/.ssh/authorized_keys]中保存</p>
<h3 id="设置文件和目录权限"><a class="markdownIt-Anchor" href="#设置文件和目录权限"></a> 设置文件和目录权限</h3>
<p>【理论说明】：</p>
<p><strong>一栏有十个字符</strong>：</p>
<ul>
<li>
<p>第一个字符用于标识是<code>文件</code>还是<code>目录</code></p>
</li>
<li>
<p>后面九个字符为三组：</p>
<ul>
<li>第一组为『文件拥有者的权限』；</li>
<li>第二组为『同群组的权限』；</li>
<li>第三组为『其他非本群组的权限』。</li>
</ul>
</li>
</ul>
<p>其中：</p>
<p>[ r ]代表可读(read)，值为 4 [二进制：100][ w ]代表可写(write)，值为 2 [二进制：010][ x ]代表可执行(execute)，值为 1 [二进制: 001][ - ]代表没有操作权限，值为 0 [二进制： 000]</p>
<p>参考来源: <a href="http://cn.linux.vbird.org/linux_basic/0210filepermission.php" target="_blank" rel="noopener">http://cn.linux.vbird.org/linux_basic/0210filepermission.php</a></p>
<p>（1）设置<code>.ssh</code>目录权限</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 文件拥有者拥有读、写、执行权限,其他组无权限</span></span><br><span class="line">chmod 700 ~/.ssh/</span><br></pre></td></tr></table></figure>
<p>（2）设置<code>authorized_keys</code>文件权限</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 文件拥有者拥有读、写权限，同群组和其他群组成员拥有读权限</span></span><br><span class="line">chmod 644 ~/.ssh/authorized_keys</span><br></pre></td></tr></table></figure>
<h3 id="对-ssh-进行配置"><a class="markdownIt-Anchor" href="#对-ssh-进行配置"></a> 对 ssh 进行配置</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 位置：/etc/ssh/sshd_config</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># 允许root用户通过ssh登录</span></span><br><span class="line">PermitRootLogin yes</span><br><span class="line"></span><br><span class="line"><span class="comment"># 允许使用ssh权限登录</span></span><br><span class="line">RSAAuthentication yes</span><br><span class="line">PubkeyAuthentication yes</span><br></pre></td></tr></table></figure>
<p>使用秘钥方式登陆后,禁用密码登录[之前密码登录的 session 将失效]</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 禁用密码登录</span></span><br><span class="line">PasswordAuthentication no</span><br></pre></td></tr></table></figure>
<p>重启 ssh</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">service sshd restart</span><br></pre></td></tr></table></figure>
<p>参考来源: <a href="https://hyjk2000.github.io/2012/03/16/how-to-set-up-ssh-keys/" target="_blank" rel="noopener">https://hyjk2000.github.io/2012/03/16/how-to-set-up-ssh-keys/</a></p>
<h2 id="本地-ssh-配置进行快捷登录"><a class="markdownIt-Anchor" href="#本地-ssh-配置进行快捷登录"></a> 本地 ssh 配置进行快捷登录</h2>
<h3 id="配置-ssh"><a class="markdownIt-Anchor" href="#配置-ssh"></a> 配置 ssh</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># ~/.ssh/config</span></span><br><span class="line"><span class="comment"># 定义登录远程主机的ssh连接名</span></span><br><span class="line">Host txyun</span><br><span class="line"></span><br><span class="line"><span class="comment"># 定义远程主机ip地址</span></span><br><span class="line">HostName &#123;ip地址&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment"># 定义远程主机的ssh端口号[默认情况下ssh端口号为22]</span></span><br><span class="line">Port 22</span><br><span class="line"></span><br><span class="line"><span class="comment"># 设置登录用户名, root用户拥有所有权限</span></span><br><span class="line">User root</span><br></pre></td></tr></table></figure>
<h3 id="进行-ssh-方式登录远程主机"><a class="markdownIt-Anchor" href="#进行-ssh-方式登录远程主机"></a> 进行 ssh 方式登录远程主机</h3>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">ssh txyun</span><br></pre></td></tr></table></figure>
<p>即可直接登录。</p>
<h2 id="总结"><a class="markdownIt-Anchor" href="#总结"></a> 总结</h2>
<p>简化了可信访客的登录步骤，并且也只有和远程服务器 ssh 认证文件中公钥相匹配的主机才能成功登录，提高了服务器的安全性。</p>
<p>完。</p>

		</div>

		
			<div class="art-item-footer">
					
						<span class="art-item-left"><i class="icon icon-chevron-thin-left"></i> <a href="/2018/07/30/python-base/" rel="prev" title="【Python】安装与配置">
							【Python】安装与配置
						</a>上一篇文章</span>
					
					
						<span class="art-item-right">下一篇文章：<a href="/2018/07/11/php-practice-wx-tp5-3/" rel="next"  title="微信小程序结合ThinkPHP5实战项目（三）-- 微信登录与令牌">
							微信小程序结合ThinkPHP5实战项目（三）-- 微信登录与令牌
						</a><i class="icon icon-chevron-thin-right"></i></span>
					
			</div>
		

		
			

    <div class="recommended_posts">
        <h3>推荐文章</h3>
        <ul>
            
                <li><a href="http://blog.i2arch.tech/2018/07/31/linux-yum源/">【CentOS】更新yum软件源</a></li>
            
                <li><a href="http://blog.i2arch.tech/2018/07/30/python-base/">【Python】安装与配置</a></li>
            
                <li><a href="http://blog.i2arch.tech/2018/07/11/php-practice-wx-tp5-3/">微信小程序结合ThinkPHP5实战项目（三）-- 微信登录与令牌</a></li>
            
                <li><a href="http://blog.i2arch.tech/2018/07/09/php-optimize/">PHP性能优化</a></li>
            
        </ul>
    </div>


		
	</section>

	

</article>
<script>
	window.subData = {
		title: '【SSH】使用SSH登录远程主机，并禁用密码登录',
		tools: true
	}
</script>

      </div>

      <!-- 右侧边栏组件 -->
      <aside class='l_side'>
        
      </aside>

      <div class="gotop">
          
    <a href='javascript:void(0)'>
        <i class="icon icon-arrow_upward flat-box">
        </i>
    </a>

      </div>
      <script>setLoadingBarProgress(60);</script>
    </div>
  </div>
  <footer id="footer" class="clearfix">

	<div class="social-wrapper">
  	
      
        <a href="https://github.com/zqunor" class="social github"
          target="_blank" rel="external">
          <span class="icon icon-github"></span>
        </a>
      
        <a href="https://www.cnblogs.com/zqunor" class="social zhihu"
          target="_blank" rel="external">
          <span class="icon icon-zhihu"></span>
        </a>
      
        <a href="/atom.xml" class="social rss"
          target="_blank" rel="external">
          <span class="icon icon-rss"></span>
        </a>
      
    
  </div>
  <div>Theme <a href='https://github.com/stkevintan/hexo-theme-material-flow' class="codename">MaterialFlow</a>  Powered by<a href="https://blog.i2arch.tech/" target="_blank">程序小工</a>.</div>

</footer>

  <script>setLoadingBarProgress(80);</script>
  

    <script src="//apps.bdimg.com/libs/jquery/2.1.4/jquery.min.js"></script>
    <script src='//cdn.bootcss.com/node-waves/0.7.5/waves.min.js'></script>
    <script src="//cdn.bootcss.com/scrollReveal.js/3.3.2/scrollreveal.min.js"></script>
    <script src="/js/jquery.fitvids.js"></script>
      <script>
        var GOOGLE_CUSTOM_SEARCH_API_KEY = "";
        var GOOGLE_CUSTOM_SEARCH_ENGINE_ID = "";
        var ALGOLIA_API_KEY = "";
        var ALGOLIA_APP_ID = "";
        var ALGOLIA_INDEX_NAME = "";
        var AZURE_SERVICE_NAME = "";
        var AZURE_INDEX_NAME = "";
        var AZURE_QUERY_KEY = "";
        var BAIDU_API_ID = "fca5b83cf69f752ddc96a61ef64a3659";
        var SEARCH_SERVICE = "hexo";
        var ROOT = "/" || "/";
        if (!ROOT.endsWith('/')) ROOT += '/';
      </script>
      <script src="/js/search.js"></script>
        <script src="/js/app.js"></script>
  <script>setLoadingBarProgress(100);</script>
</body>
</html>
